It was discovered that the abrt-dbus D-Bus service does not properly check the validity of the problem directory argument in the ChownProblemDir, DeleteElement, and DeleteProblem methods. A local attacker could use this flaw take ownership of arbitrary files and directories, or to delete files and directories as the root user. Acknowledgements: This issue was discovered by Florian Weimer of Red Hat Product Security.
These upstream commits fix this cve: https://github.com/abrt/abrt/commit/b7f8bd20b7fb5b72f003ae3fa647c1d75f4218b7 https://github.com/abrt/abrt/commit/6e811d78e2719988ae291181f5b133af32ce62d8 https://github.com/abrt/abrt/commit/7814554e0827ece778ca88fd90832bd4d05520b1 https://github.com/abrt/libreport/commit/1951e7282043dfe1268d492aea056b554baedb75
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2015:1083 https://rhn.redhat.com/errata/RHSA-2015-1083.html